| 💼 A.9.1 Business requirements of access control | 2 | 17 | 18 | | no data |
| 　💼 A.9.1.1 Access control policy | | | | | no data |
| 　💼 A.9.1.2 Access to networks and network services | | 17 | 18 | | no data |
| 💼 A.9.2 User access management | 6 | 16 | 26 | | no data |
| 　💼 A.9.2.1 User registration and de-registration | | 1 | 1 | | no data |
| 　💼 A.9.2.2 User access provisioning | | 4 | 4 | | no data |
| 　💼 A.9.2.3 Management of privileged access rights | | 3 | 12 | | no data |
| 　💼 A.9.2.4 Management of secret authentication information of users | | 8 | 10 | | no data |
| 　💼 A.9.2.5 Review of user access rights | | 1 | 1 | | no data |
| 　💼 A.9.2.6 Removal or adjustment of access rights | | | | | no data |
| 💼 A.9.3 User responsibilities | 1 | 3 | 3 | | no data |
| 　💼 A.9.3.1 Use of secret authentication information | | 3 | 3 | | no data |
| 💼 A.9.4 System and application access control | 5 | 20 | 22 | | no data |
| 　💼 A.9.4.1 Information access restriction | | 19 | 20 | | no data |
| 　💼 A.9.4.2 Secure log-on procedures | | | 1 | | no data |
| 　💼 A.9.4.3 Password management system | | 1 | 1 | | no data |
| 　💼 A.9.4.4 Use of privileged utility programs | | | | | no data |
| 　💼 A.9.4.5 Access control to program source code | | | | | no data |